refactoring: storing only the userId, not a user object, into the session in order to eliminate confusion